CVE-2026-40413
HighUpdated
Published: 12 May 2026
Published
12 May 2026
Modified
01 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1
7.4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score
0.0014
34.2th percentile
Risk Priority
15
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-40413 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 11 23H2. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29670
Vulnerability details
Windows TCP/IP Denial of Service Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?
Null pointer dereference in TCP/IP stack directly enables Endpoint DoS via system exploitation (T1499.004).
Confidence: HIGH · MITRE ATT&CK Enterprise v18.1
CVEs Like This One
CVE-2026-40401Same product: Microsoft Windows 10 1607
CVE-2026-40414Same product: Microsoft Windows 10 1607
CVE-2026-32071Same product: Microsoft Windows 10 1607
CVE-2026-21525Same product: Microsoft Windows 10 1607
CVE-2026-20875Same product: Microsoft Windows 10 1607
CVE-2025-21285Same product: Microsoft Windows 10 1607
CVE-2026-25165Same product: Microsoft Windows 10 1607
CVE-2026-35424Same product: Microsoft Windows 10 1607
CVE-2026-20846Same product: Microsoft Windows 10 1607
CVE-2026-21243Same product: Microsoft Windows Server 2019
Affected Assets
microsoft
windows 10 1607
≤ 10.0.14393.9140
microsoft
windows 10 1809
≤ 10.0.17763.8755
microsoft
windows 10 21h2
≤ 10.0.19044.7291
microsoft
windows 10 22h2
≤ 10.0.19045.7291
microsoft
windows 11 23h2
≤ 10.0.22631.7079 · ≤ 10.0.22631.7079
microsoft
windows 11 24h2
≤ 10.0.26100.8390 · ≤ 10.0.26100.8390
microsoft
windows 11 25h2
≤ 10.0.26200.8390 · ≤ 10.0.26200.8390
microsoft
windows 11 26h1
≤ 10.0.28000.2113 · ≤ 10.0.28000.2113
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.9140
+4 more product configuration(s) — see NVD for full list
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.